diff --git a/netstack/src/filter/conntrack.rs b/netstack/src/filter/conntrack.rs
index d8c2673694..53febed445 100644
--- a/netstack/src/filter/conntrack.rs
+++ b/netstack/src/filter/conntrack.rs
@@ -167,6 +167,7 @@ pub struct ConntrackTable {
     icmp_rate_limits: BTreeMap<IpAddress, (u32, Instant)>,
     over_limit_count: u64,
     icmp_error_count: u64,
+    max_entries: usize,
 }
 
 fn advance_entry_state(entry: &mut ConnEntry, is_orig: bool, ctx: &PacketContext, now: Instant) -> bool {
@@ -252,6 +253,7 @@ impl ConntrackTable {
             icmp_rate_limits: BTreeMap::new(),
             over_limit_count: 0,
             icmp_error_count: 0,
+            max_entries: 65536,
         }
     }
 
@@ -328,6 +330,11 @@ impl ConntrackTable {
             Duration::from_secs(60)
         };
 
+        if self.entries.len() >= self.max_entries {
+            self.over_limit_count = self.over_limit_count.saturating_add(1);
+            return ConnState::OverLimit;
+        }
+
         self.entries.insert(
             key.clone(),
             ConnEntry {
@@ -397,6 +404,10 @@ impl ConntrackTable {
             if self.entries.contains_key(&key) {
                 return ConnState::Established;
             }
+            if self.entries.len() >= self.max_entries {
+                self.over_limit_count = self.over_limit_count.saturating_add(1);
+                return ConnState::OverLimit;
+            }
             self.entries.insert(
                 key.clone(),
                 ConnEntry {
@@ -556,6 +567,7 @@ impl ConntrackTable {
         out.push_str(&alloc::format!("icmp_entries: {}\n", icmp));
         out.push_str(&alloc::format!("over_limit: {}\n", self.over_limit_count));
         out.push_str(&alloc::format!("icmp_errors: {}\n", self.icmp_error_count));
+        out.push_str(&alloc::format!("max_entries: {}\n", self.max_entries));
         out.push_str(&alloc::format!("total_entries: {}\n", self.entries.len()));
         out
     }